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The Examiner has rejected Claims 1, 10 and 14 under 35 U.S.C. 103(a) as being unpatentable 
over Gleichauf et al. (6,499,107), in view of Chiu (5,101.402). The Examiner has further rejected 
Claims 1-17 under 35 U.S.C. 103(a) as being unpatentable over McCreery et al. (5,787,253), in 
view of Chiu (5,101,402). The Examiner hi\s further rejected Claims 1 - 17 under 35 U.S.C. 103(a) 
as being unpatentable over Abromavage et al. (WO 00/6881 1), in view of Chiu (5.101,402). 

In each rejection, the Examiner has admitted that the primary references do not specifically 
teach the step of sending one or more messages to the second analyzer responsive to unsuccessful 
session reconstruction on the first analyzer and the second analyzer recognizes the unrecognized 
packets to successfully reconstruct the session. The Examiner further argues that it would have been 
obvious to a person of ordinary skill in the art at the time the invention was made to modify such 
primary references in view of Chiu to provide die claimed features lacking in the primary references. 

Applicant respectfully disagrees with this assertion, as it appears that the Examiner has not 
considered the fiill weight of applicant's claims. Specifically, appHcant claims, in each of the 
independent claims: 

"wherein the one or more messages from the first analyzer to the second analyzer comprise 
packets received by the first analyzer wliich are unrecognized, and the second analyzer recognizes 
the unrecognized packets to successfully reconstruct the session." (or similar language) 

To this end, the Examiner's proposed combination still fails to meet applicant's claimed 
invention. Specifically, the Examiner rcUes on Fig. 9 and the following excerpt from Chiu to make a 
prior art showing of the foregoing claim limitations. 

''Other types of packets can exist on a DECnet network. The various types of 
DNA packets include "terminate session" packets; "link service" packets; 
and "ACK" packets acknowledging receipt of a packet. 

In addition, yet other types of packets exist on a DECnet. These other 
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types of packets are well-kno\vn in the networking art and will not be 
described herein. 

FIG 8c shows a session key which has been extracted from either the packet 
header of FIG. 8a or the packet header of FIG. 8b. A unique session key is 
extracted for each session and serves to identify the packets of the 
session. Each session key preferably is 32 bits long and ^^"^P^^^^%^f ^^^^^^ 
from the Initiator DECnet Node Address field and 16 bits from the Initiator 
Logical Link Address field of the initiator address 138/158 in the packet 
header . 

FIG. 9 is a flow chart of the steps of the method of the present invention 
performed by the session information collecting part 92 to process a packet 
header from a Transport Layer level packet. If the packet header is from a 
Session Control packet, such as the ^connect initiate packet of FIG. 8a, 
(Step 160), control passes to Step C of FIG. 10. If the packet header is 
from a data packet, such as the packet header of FIG. 8b, (Step 162), 
control passes to Step D of FIG, 11. If the packet header is from a Link 
service packet (Step 164), control passes to Step E of FIG. 12. If the 
packet header is from an ACK packet (Step 166) , control passes to Step F of 
FIG 13 If the packet header is from some other type of packet, then the 
unknown packet type is processed (Step 168)." (col. 8, line 61 - col. 9, 



25) 



Sxich excerpt, however, merely suggests a technique for managing packets based on a header 
thereof. This clearly falls short of the speci fic functional intera ction between a first and second 
analyzer , as claimed by apphcant. 

Specifically, there is no "sending one or more messages to the secon d analyzer" in response 
to the specific condition of an "^ unsuccessful session reconstruction, " as claimed, '^wherein the one or 
more messages fi^om the first analyzer to the second analyzer comprise packets received by the first 
analyzer which are unrecognized, and the second analyzer recoenizes the unrecognized packets to 
successfully reconstruct the session ," (or sunilar language) 

Applicant argues that the clear deficiencies in the Examiner's proposed combinations would 
not have been obvious, since such aspects of the claimed invention provide such paramount benefits. 
By applicant's unique claimed features, the present invention is capable of better dealing with 
unrecognized packets by sending them to another analyzer for recognizing the unrecognized packets 
to successfiilly reconstruct the session. Applicant contends that simply nowhere in the prior art is 
there such a multi-analyzer technique, as specifically claimed, for improved session reconstruction. 
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To establish a prima facie case of obviousness, three basic criteria must be met. First, there 
must be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine reference 
teachings. Second, there must be a reasonable expectation of success. Finally, the prior art reference 
(or references when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of success must both be 
found in the prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438(Fed.Cir.l99l). 

Applicant thus respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met , since the Examiner*s cited excerpts do not disclose, teach or suggest 
applicant's claim language, as set forth hereinabove. 

It is further noted that the Examiner's proposed combination continues to fail to meet the 
specific limitations of applicant's dependent claims. Specifically, the Examiner relies on the 
foregoing primary references to meet applicant's claimed: 

'Vherein the one or more messages from the first analyzer to the second analyzer further 
comprise hints generated by the Brst analyzer" (see Claim 3 et al.); 

*Vherein hints for a packet comprise a time the packet was received and an address 
information for the packet" (see Claim 4 et al); and 

"wherein the packets received at the first analyzer are output firom a filter for controlhng 
which packets in a plurality of packets flowing into the filter reach the first analyzer" (see 
Claim 5 et al.). 

The primary references, however, do not even suggest the specifically claimed sending of 
messages between a first analyzer and a second analyzer, let alone the particular content of such 
messages that is claimed in the foregoing dependent claims. 
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Again, applicant thus respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met , since the Examiner's cited excerpts do not disclose, teach or 
suggest applicant's claim language, as set forth hereinabove. 

A notice of allowance or a specific prior art showing of all of applicant's claimed features, in 
combination with the remaining claim elements, is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 505-5 100. For payment of the fees due in connection 
with the filing of this paper, the Commissioner is authorized to charge such fees to Deposit Account 
No. 50-1351 (Order No. XACTP016). 
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